Ask five research firms what the voice payments market is worth and you get five different universes. The Business Research Company puts voice-based payments at $10.94 billion for 2025; Fortune Business Insights says $8.79 billion; one report sizes “voice payment software” at $21.5 billion. When analysts disagree by a factor of fifteen, the category has not settled — and the market-size slide is the least useful thing you can show a client this quarter.
What actually shipped in 2026 is narrower and far more actionable: payment capture became an API feature, a live voice-payment lane reached production, and the standards body that governs card data published its first guidance on AI systems. All three point to the same decision, which has to be made before go-live.
What actually shipped this year
Payment capture became a product feature. Telnyx put a Voice Payments API into beta that lets a caller key a card mid-conversation while the recording is masked, transcription pauses, and the digits are withheld from your agent and your webhooks. You get a result and a token, with the card shown as last four.
Voice payments reached production in a real vertical. AsiaPay launched a Voice Pay pilot in September 2026 that attaches a spoken instruction to a customer’s existing card or wallet, handling authentication, routing and fraud behind the voice interface. On October 20 a Sierra agent and Stripe went live taking bill payments by phone: the agent hands the call to a secure mode, the caller keys the digits, and the agent only ever sees status and the last four. Sierra reports that 71.3% of calls where a patient starts a payment with its healthcare agent end in a successful payment — a vendor-reported figure with no published methodology.
None of these let the model near the card. The innovation is a handoff, not an understanding — the same shift described in our look at voice agents moving from support into payments.
The three ways a card number can enter a call
Your compliance exposure is decided by which of these you choose. Pick it on the whiteboard, not in production.
1. Spoken capture. The caller reads the number and security code aloud. The agent hears it, the recorder keeps it, the transcriber prints it, the summarizer quotes it, the CRM stores it. Every artifact now needs a suppression or deletion control, and every control is a place that fails silently when a vendor changes a default. This path is why the industry went looking for a handoff.
2. DTMF suppression. The caller keys the digits; the platform masks the tones from the agent and the recording and routes the data to the processor separately. The catch is human: a caller who reads the code aloud out of habit defeats the masking, so the fallback — not the happy path — is what an assessor will test. A 2026 guide to PCI compliance for AI voice payments agrees: DTMF suppression is the best balance for teams that must take payment on the call, provided the fallback is tested, not assumed.
3. Payment link or secure handoff. The agent texts or emails a link, or hands the call to a payment session. Nothing card-related crosses the audio path, so recordings and transcripts stay clean by construction. The tradeoff is abandonment at the extra step. A control that never fires cannot misfire — the safest default for any client who tolerates the friction.
One rule sits above all three: card verification codes cannot be stored after authorization in any form, and the standards body’s audio-recording FAQ says that explicitly includes storing them in a digital audio recording. If transcripts and summaries are copied into a warehouse, the warehouse just joined the assessment.
The governance shift nobody priced in
On October 9, 2026, the PCI Security Standards Council published Security Considerations for AI Systems. It is advisory and existing PCI requirements still take precedence, but its recommendations preview next year’s assessment questions:
- For agents with access to cleartext cardholder data, explicit human approval for actions involving that data is recommended.
- Secrets belong in a secrets manager — never in source, prompts, model context, outputs or logs.
- DLP controls must operate independently of the AI; logs must support investigations without retaining payment data.
- Scoping should account for training data and detokenization tools: access to tokenized data plus a way to detokenize counts as access to readable data.
Translated for an agency team: your agent’s memory, tool permissions and evaluation datasets are now part of the compliance story. Golden test sets are the quiet offender — often built from real transcripts, so real card data lands in a repository nobody scoped. Keep detokenization out of any service the agent can call, or you have rebuilt spoken capture with extra steps.
A six-point pre-launch gate
- Declare the capture path (link, then DTMF, then spoken) and document the fallback behavior.
- List every artifact that can hold digits: recording, transcript, summary, CRM note, model logs, evaluation sets, support exports.
- Attack your own flow by reading a card number and CVV aloud. If the CVV surfaces anywhere, you are not done.
- Keep the model out of the payment tool loop. Status and last four only; no credential that reveals more.
- Set approval thresholds for refunds and charges above a fixed amount, with a reversal procedure and a named owner.
- Instrument the drop-off. Completion after the payment prompt and abandonment inside secure mode decide whether the flow is worth its scope.
That last point is the business case, and it is why per-call cost deserves the scrutiny in our breakdown of voice AI cost per call: a flow that saves 90 seconds and loses a third of callers at the secure handoff is a net loss however cheap the minute rate looks.
Where the agency money is
Not in reselling a voice payments platform — those are beta APIs with unpublished pricing, and the vendor will sell direct once the account is big enough. The durable work is the unglamorous middle: scoping what the assessment will see, designing a call flow where the card never reaches the model, testing the fallback, and documenting the chain so an assessor can read it. It is billable, recurring, and hard to hand to a cheaper vendor because it depends on knowing the client’s systems.
Two cautions. You are not a QSA and should never promise certification — promise a smaller, defensible scope, which is what clients actually buy. And the fraud surface grows with the channel: synthetic voices now call into contact centers at industrial volume, the problem covered in what changes when AI voice agents are the ones calling you. A payment-capable agent with no caller-authentication step is an expensive lesson waiting for a quarterly review.
The market number will be wrong in both directions for another two years; your client’s architecture will be wrong for longer if nobody picks the capture path before launch. If you are adding payments to a live voice agent, have us scope the PCI footprint and call flow first — the exercise usually removes systems from the assessment instead of adding them.